Bug 471237 (CVE-2008-5102)

Summary:	CVE-2008-5102 Zope 2, conga: DoS via various python scripts insufficiencies
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bstevens, iannis, jonathansteffan, rmccabe
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-12-24 02:09:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2008-11-12 16:03:57 UTC

A security flaw was discovered in python scripts shipped within the Zope application server framework of version 2. Local user with unrestricted
access to the ZMI and ability to edit python scripts could use this flaw
to cause the whole Zope 2 instance shutdown or to import the 'test' module
of Python and execute all tests (DoS).

Affected Zope 2 versions: Zope 2.7.0 to Zope 2.11.2

Proposed patch: http://www.zope.org/Products/Zope/Hotfix-2008-08-12/Hotfix_20080812-1.1.0.tar.gz

References:
http://bugs.gentoo.org/show_bug.cgi?id=246411
http://www.zope.org/Products/Zope/Hotfix-2008-08-12/README.txt
http://www.zope.org/Products/Zope/Hotfix-2008-08-12/Hotfix_20080812-1.1.0.tar.gz


Note: This issue also affects the PythonScripts of the Zope 2 package,
      as shipped within the Conga project:
        -- conga-0.9.1-8 contains Zope-2.7.5 RC2
        -- conga-0.12.0-7.el5 contains Zope-2.8.4

Comment 1 Jan Lieskovsky 2008-11-12 16:08:30 UTC

This issue affects the conga package, as shipped with Red Hat Enterprise Linux
5 Update 2 (conga-0.12.0-7.el5), with Red Hat Enterprise Linux 4 Cluster Suite (conga-0.9.1-8) and within the Extra Packages for Enterprise Linux 5 project
(zope-2.10.6-1.el5).

This issue does NOT affect the versions of the python-zope-interface package,
as shipped within the Fedora releases of 8, 9 and 10 and withing EPEL 4 and 5.

Comment 2 Tomas Hoger 2008-11-18 08:08:42 UTC

CVE id CVE-2008-5102 was assigned to this issue:

PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements.

Comment 3 Jonathan Steffan 2009-09-07 22:09:25 UTC

The zope currently in EPEL is not vulnerable as the hotfix was integrated as of Zope 2.10.7, currently 2.10.9 is latest:

http://koji.fedoraproject.org/koji/buildinfo?buildID=126121